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l m Title of Invention 

IMPROVED ALERT GENERATION FOR TREND 
PERFORMANCE ANALYSIS 



2. Claims 

1 . A system 26 for generating an alert from data obtained from a 
process, comprising: 

a normalizer 32 for normalizing the data; 

a classifier 33 for classifying the normalized data in a multi-dimensional 
space defined for a plurality of variables in the process, the normalized data 
classified into a normal class or an abnormal class defined in the multi- 
dimensional variable space, wherein tine normal class is indicative of normal 
operating conditions for the process and the abnormal class is indicative of 
potential alert conditions in the process; 

an alert level evaluator 29 for evaluating a vigilance level of the 
classified data for related variables, said alert level evatuator 29 increasing 
the vigilance level following a suspicious data reading data classified in the 
abnormal class and decreasing the vigilance level following a data reading 
classified in the normal class; and 

an alert score generator 29 for generating an alert score for each of the 
related variables according to the vigilance level. 

2. The system 26 according to claim 1, wherein said normalizer 32 
comprises means for centering the data about a selected center point. 

3. The system 26 according to claim 1 , wherein said classifier uses 
a fuzzy knn algorithm to classify data in the normal class and the abnormal 
class. 

4. The system 26 according to claim 1, further comprising a 
statistical property estimator 30 for estimating a plurality of statistical 
properties of the obtained data. 
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5. The system 26 according to claim 4. wherein said statistical 
property estimator 30 estimates a mean and standard deviation of the 
classified data. 

6. The system 26 according to claim 4, further comprising an 
adaptor 31 for smoothing the statistical properties estimated by said statistical 
property estimator 30. 

7. The system 26 according to claim 1, wherein the alert condition 
is representative of at least one of a failure, a fault condition, or symptoms of 
an incipient failure condition. 

8. The system 26 according to claim 1, wherein the alert score 
generator 29 aggregates each of the alert scores for the related variables into 
a composite score. 

9. A system 26 for generating an alert from data obtained from an 
aircraft engine 12 process, comprising: 

a normali2er 32 for normalizing the data obtained from said aircraft 
engine 12 process; 

a classifier 33 for classifying the normalized data in a multi-dimensional 
space defined for a plurality of variables in the aircraft engine 12 process, the 
normalized data classified into a normal class or an abnormal class defined In 
the muiti-dimensional variable space, wherein the normal class is indicative of 
normal operating conditions for the aircraft engine 12 process and the 
abnormal class is indicative of potential alert conditions in the aircraft engine 
12 process; 

an alert level evaluator 29 for evaluating a vigilance level of the 
classified data for related variables, said alert levBl evaluator 29 increasing 
the vigilance level following a suspicious data reading data classified in the 

abnormal class and decreasing the vigilance level following a data reading 
classified in the normal class; and 

an alert score generator 29 for generating an alert score for each of the 
related variables according to the vigilance level. 
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10. A method for generating an alert from data obtained from an 
aircraft engine 12 process, comprising: 

normalizing the data obtained from said aircraft engine 12 process; 

classifying the normalized data in a multi-dimensional space defined 
for a plurality of variables in the aircraft engine 12 process, the normalized 
data classified into a normal class or an abnormal class defined in the multi- 
dimensional variable space, wherein the normal class is indicative of normal 
operating conditions for the aircraft engine 12 process and the abnormal class 
is indicative of potential alert conditions in the aircraft engine 12 process; 

evaluating a vigilance level of the classified data for related variables, 
said evaluating comprising increasing the vigilance level following a 
suspicious data reading data classified in the abnormal class and decreasing 
the vigilance level following a data reading classified in the normal class; and 

generating an alert score for each of the related variables according to 
the vigilance level. 
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3. Detailed Description of Invention 

BACKGROUND OF THE INVENTION 

This invention relates generally to trend performance analysis and 
more particularly to detecting an abnormal condition in a multi-sensor 
environment using a composite change score. 

Trend performance analysis is typically used to monitor and analyze 
sensor data and derived values for a technical process. One type of technical 
process where trend performance analysis Is used Is with aircraft engines. In 
this example, engine data are sampled from an airplane at different times of 
the flight and transmitted to a ground station. The data are collected and 
distributed to an aircraft engine expert for that particular airplane fleet The 
data are preprocessed and evaluated by a trend performance analysis tool. 
In particular, the trend performance analysis tool monitors a multitude of 
engine variables. Data for each variable are compared against trending 
baseline data. If the data for a particular variable exceed a predetermined 
threshold limit and the data are not considered to be outliers, then the trend 
performance analysis tool issues an alert Typically, the predetermined alert 
threshold limit for each variable is set at a level that Is below a limit that would 
generate a fault warning flag In the cockpit of the airplane. In particular, the 
predetermined alert threshold limit for each variable Is at a level that would 
create an awareness of a potential problem before it turns into an event that 
could result In a revenue loss for the airplane. Examples of potential revenue 
loss situations are a grounding of an airplane, damage to an engine, 
departure delay, etc. 

After the trend performance analysis tool issues an alert, the aircraft 
engine expert examines trend charts for each of the variables in order to 
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determine if an event has truly occurred which warrants further action. If the 
data in any of the trend charts are suspicious, then the aircraft engine expert 
notifies the fleet management of that particular airplane and suggests actions 
to further diagnose and/or actions to correct any causes for the alert. 
Examples of possible actions are boroscoping the engine, engine washing, 
overhauling the engine, etc. A problem with this approach is that many alerts 
are generated which are false and do not warrant further diagnostic or 
corrective actions. There are a number of reasons for the high number of 
false alerts being issued. One is that the data quality varies considerably 
between different engines* Another reason is that predetermined alert 
threshold levels for a variable are preset globally and not selected for an 
individual airplane. Other reasons for issuing an excessive number of alerts 
are noise generated from poorly calibrated and deteriorating sensors, the use 
of faulty data acquisition systems, and slow wear of the engine which results 
in a constant change of normal operating conditions. 

If too many alerts are generated, then the aircraft engine expert has to 
constantly examine the trend charts to eliminate the false alerts from the true 
alerts. Constantly examining the trend charts becomes a very time 
consuming task when there Is a large number of engines to monitor, as 
typically is the case for a large fleet of airplanes. In addition, the expert's 
senses may become dulled to the true alerts due to the large amount of false 
positive alerts. Therefore, there Is a need for a mechanism that alerts the 
expert of a truly suspicious situation, produces less false positive alerts and 
assists In reducing the excessive number of false alerts generated by a trend 
performance analysis tool without sacrificing the ability to detect true alerts. 

SUMMARY OF THE INVENTION 

This invention is able to find a truly suspicious situation by using 
abnormal condition detection along with a multi-dimensional approach to 
classify data. Abnormal condition detection does not try to classify an 
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observation into particular faults. Rather, abnormal condition detection bins 
data into only two classes, "normal" and "abnormal". In this invention, an 
abnormal engine condition is detected by assessing data for several related 
engine variables and classifying the data as either normal or abnormal. 

In order to assess the state of the engine, the data are evaluated to 
determine an alert level, in this evaluation, data for the related engine 
variables are examined on a multi-variate level to detect shifts. Generally, the 
more variables that are shifting at the same time, the more likely that there 
has been a suspicious change. A persistency checker Increases a vigilance 
level as more suspicious data are encountered and decreases the level if 
normal data are encountered. The effect of the persistency checker is that 
alerts are not reported hastily. Rather the persistency checker requires a 
confirmation before increasing the level of alertness. Thus, outliers from both 
the normal class to the abnormal class and from the abnormal class to the 
normal class do not reset the alerting mechanism inadvertently. A composite 
alert score generator determines an alert score for each of the related engine 
variables based on the vigilance levels noted by the persistency checker. The 
composite alert score generator aggregates the alert scores for each of the 
related variables and then issues an alert when the vigilance level for the 
aggregate score surpasses a preset threshold. 

In accordance with this Invention, there is provided a system and a 
method for generating an alert from data obtained from a process. In this 
embodiment, a normaiizer normalizes the data. A classifier classifies the 
normalized data in a multi-dimensional space defined for a plurality of 
variables In the process. The normalized data are classified into a normal 
class or an abnormal class defined in the multi-dimensional variable space. 
The normal class is indicative of normal operating conditions for the process 
and the abnormal class is Indicative of potential alert conditions in the 
process. An alert level evaluator evaluates a vigilance level of the classified 
data for related variables. The alert level evaluator increases the vigilance 
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level following a suspicious data reading classified in the abnormal class and 
decreases the vigilance level following a data reading classified in the normal 
class. An alert score generator generates an alert score for each of the 
related variables according to the vigilance leveL 

In accordance with another embodiment of this invention, there is 
provided a system and method for validating an alert generated from a trend 
performance analysis tool used to monitor data obtained from a process. In 
this embodiment, a normalizer normalizes the data monitored by the trend 
performance analysis tool. A classifier classifies the normalized data in a 
multi-dimensional space defined for a plurality of variables in the process. 
The normalized data are classified into a normal class or an abnormal class 
defined in the multi-dimensional variable space. The normal class is 
indicative of normal operating conditions for the process and the abnormal 
class is indicative of potential alert conditions in the process, An alert level 
evaluator evaluates a vigilance level of the classified data for related 
variables. The alert level evaluator increases the vigilance level following a 
suspicious data reading classified in the abnormal class and decreases the 
vigilance level following a data reading classified in the normal class. An alert 
score generator generates an alert score for each of the related variables 
according to the vigilance level The alert generated from the trend 
performance analysis tool is valid if the alert score satisfies a predetermined 
score. 

DETAILED DESCRIPTION OF THE INVENTION 

The improved alert generation associated with this invention Is 
described with reference to an aircraft engine used by an aircraft such as an 
airplane, however, other aircraft (e.g., a helicopter) are possible. Although 
this invention is described with reference to an aircraft engine, the invention 
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can be used in conjunction with any system such as a turbine, a power 
system, a locomotive, a chemical or mechanical process plant, or another 
process which generates sensor data where it is desirable to monitor or 
diagnose system behavior. Fig. 1 shows a block diagram of a system 10 for 
monitoring and maintaining an aircraft engine 12 according to the prior art. In 
this system 10, engine data are sampled from the aircraft engine 12 from an 
airplane 14. The engine data are sampled at different times of the flight such 
as during the take-off, the climb and the cruise either continuously or in 
snapshots. The engine data are transmitted during or after the flight to a 
centralized data center and stored in a database 16. The data are then 
collected, distributed and preprocessed by a preprocessor 17. 

After preprocessing, data features are evaluated by a trend 
performance analysis tool 1 8, which monitors a multitude of engine variables. 
Data features are raw data that have been cleaned of errors not compatible 
with further processing in the system or data which have been transformed to 
yield information beyond the raw data (e.g., statistical properties, 
transformations into a different domain, principle component analysis, etc.) 
The trend performance analysis too) 18 may be any general-purpose trend 
performance analysis tool that can monitor on-line sensor data, variables, and 
features of a technical process. Features are compared against trending 
baseline features. If the feature for a particular variable exceeds a 
predetermined threshold limit, then the trend performance analysis tool 18 
Issues an alert to a remote service unit 20. An alert is indicative of a failure, a 
fault condition, or symptoms of an incipient failure condition. An aircraft 
engine expert located at the remote service unit monitors trend charts and 
alerts generated by the trend performance analysis tool 18. The aircraft 
engine expert then decides whether a true alert exists and generates a report 
to a fleet management unit 22. If the report suggests that remedial or 
diagnostic actions are needed, then personnel at the fleet management unit 
22 prepare a schedule of the suggested actions. Maintenance personnel 24 
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then perform the actions (e.g., boroscoping the engine, engine washing, 
overhauling the engine) as set forth in the schedule prepared by the fleet 
management unit 22. 

As mentioned above, one of the problems associated with the system 
1 0 for monitoring and maintaining an aircraft engine according to the prior art 
is that there are many alerts generated from the trend performance analysis 
tool 18 which are false and do not warrant further diagnostic or corrective 
actions. When too many alerts are generated the aircraft engine expert has to 
constantly examine the trend charts to distinguish the false alerts from the 
true alerts. Constantly examining the trend charts is a very time consuming 
task for the aircraft engine expert, since the expert typically has the 
responsibility of monitoring a large number of engines for a particular fleet In 
addition, it may cloud the expert's attentiveness for true alerts. 

Fig. 2 shows a block diagram of a system 26 for monitoring and 
maintaining an aircraft engine according to this invention. In this embodiment, 
alerts are detected by using a multivariate abnormal condition detector 28. 
First, the multi-variate abnormal condition detector 28 estimates some 
statistical properties of the preprocessed data from the aircraft engine 12 and 
smoothes the estimated properties to follow slow drifts that develop overtime. 
Then the multi-variate abnormal condition detector 28 normalizes the data. In 
particular, variables defined for the aircraft engine are normalized individually. 
The aircraft engine variables that are normalized are delta exhaust gas 
temperature (dEGT), which is the deviation from the baseline EGT, fuel flow 
(WF), core speed (N2), and EGT divergence, divEGT, which is the difference 
of the EGT between the raw EGT of the engine in question and the mean of 
raw EGT of all engines. Other variables may be normalized such as WF 
divergence, divWF, which is the difference of the WF between the WF of the 
engine In question and the mean of WF of all engines, and N2 divergence, 
divN2, which is the difference of the N2 between the N2 of the engine in 
question and the mean of N2 of all engines. These variables are illustrative of 
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some of the aircraft engine variables that can be normalized in this invention 
and are not an exhaustive list. The multivariate abnormal condition detector 
28 assesses the normalized data for the aircraft engine variables 
simultaneously, instead of one process variable at a time. In particular, the 
multi-variate abnormal condition detector 28 classifies the normalized data in 
a multi-dimensional space defined for the plurality of engine variables. The 
normalized data are classified into a normal class or an abnormal class 
defined in the multi-dimensional variable space. The normal class is 
indicative of normal operating conditions for the aircraft engine and the 
abnormal class is indicative of potential alert conditions in the engine. Below 
is a more detailed explanation of the statistical property estimation, 
smoothing, normalization and classification steps performed by the multi- 
variate abnormal condition detector 28. 

The system 26 in Fig, 2 also comprises an alert evaluator 29, which 
evaluates the classified data and determines whether the data are a true alert 
or a false alert. In particular, the alert evaluator 29 generates an alert level of 
the data. More specifically, the alert evaluator 29 generates a vigilance level 
of the data for each reading for related variables. Related variables could be 
dEGT and divEGT, WF and divWF and N2 and dlvN2. Each vigilance level is 
indicative of suspicious data. If suspicious data are encountered, the 
vigilance level for the reading Is increased by a notch. If the following data 
reading are normal, then the vigilance Is decreased by one notch. The alert 
evaluator 29 then generates an alert score based on the vigilance level for 
each of the related variables. Afterwards, the alert evaluator 29 aggregates 
the alert scores into a composite alert score for the Individual related variable 
pairs. Below is a more detailed explanation of the steps performed by the alert 
evaluator 29. 

Fig. 3 shows a more detailed view of the multi-variate abnormal 
condition detector 28. The multi-variate abnormal condition detector 28 
receives preprocessed engine variable data from the preprocessor 17. The 
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preprocessor 17 ensures that there are no missing data entries for any 
particular variable and that the data are new data (i.e., there are no repeated 
entries from earlier runs). Should the preprocessor 17 find any old data, it will 
disregard those and take only those which are found to be new. This is done 
to prevent repeated processing of the same data. The date of the data is 
determined by comparing incoming data against a date/time stamp stored for 
the last flight processed for each engine. That date/time stamp is later 
updated as more data are obtained. 

Referring to Fig. 3, the multivariate abnormal condition detector 28 
comprises a statistical property estimator 30 that estimates some statistical 
properties of the preprocessed data such as mean and standard deviation of 
the data as well as the mean of the normal region. Preferably, the statistical 
property estimator 30 estimates the mean and standard deviation on the "fly" 
using only the mean of the previous calculation, the size of the virtual window, 
the standard deviation of the previous calculation and a temporary variable. 
In particular, the mean estimation is determined as: 

tt 

wherein 



x(k) is the current data point at time k\ 
is the estimated mean at time k\ 
\s the estimated mean at time k-1\ and 
n Is the virtual window site. 




(29) 

The estimation for the standard deviation is determined as: 
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wherein 

oik) 

is the estimation of the standard deviation at time k\ 
s(k) is an auxiliary variable; and 

Ilk) 

is the estimated mean at time k 

The auxiliary variable V for the standard deviation is estimated by the 
following: 



4k)-&-0+ * k)t ~* k ~° (3) 



wherein 



s(k-1) is the auxiliary variable at time k-1; 
x(k) is the data point at time k\ and 
n is the site of the virtual window. 

Referring back to Fig. 3, the muiti-variate abnormal condition detector 
28 also comprises an adaptor 31 for smoothing the statistical properties 
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estimated by the statistical property estimator 30. The purpose of the adaptor 
31 is to smooth the estimation for the mean and standard deviation and to 
follow slow drifts over time. Slow drifts are a function of mechanical, 
chemical, and thermal wear and is much smaller than alert conditions. 
Preferably, the adaptor 31 is essentially an exponential weighted moving 
average (EWMA) filter which sits on top of the statistical property estimator. 
In this invention, the smoothing parameter, alpha, associated with the adaptor 
31 can be designed to react to changes faster or less fast. In addition to the 
smoothing parameter, adaptor 31 uses a window size M n" to also determine 
the smoothness of the adaptation. The larger the window, the smoother the 
adaptation. The adaptor 31 is governed by the following: 



f{*) = c*(*-l) + (l-a)f(*} (4) 

where 

?(*)is the smoothed mean 

a is the smoothing constant 
and the equation for adapting the standard deviation is defined as: 



cr{k) = acr{k - 1)+ (i - a)a{k) 
where 

d{k) is the smoothed standard variation 



(5) 
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The mufti-variate abnormal condition detector 28 also comprises a 
normalizer 32 that normalizes the smoothed engine variable data. The 
normalizer 32 takes the data and centers them around a chosen center point 
that can be any point in the feature space. For example, for a two- 
dimensional space, it could be the point (0,0) or point (0.5, 0.5), etc. The 
normalizer 32 then uses a user-specified variance to perform the 
normalization for each variable. The normalizer 32 normalizes the engine 
data individually for each engine variable (i.e., dEGT, WF, N2 f and EGT 
divergence) according to normalizing parameters. In particular, a user 
specified, predetermined number of Initial data readings for each variable 
which are validated to be "normal* (e.g., through supervision) are used to 
obtain the normalization parameters. All following data readings are then 
scaled according to the normalization parameters. While several 
normalization procedures can be used, the preferred one is governed by the 
equation: 
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normalized „ _ f 



wherein 

Xnomwifced is the normalized variable; 
x Is the raw reading; 

is the maximum value of the data computed by: 
jc mtx 22 mean + stretch _radtus * scale- sigma ; 

stretctwadius is a variable denoting the radius which is larger 
during the initialization period (governed by first_n) and shrinks to the 
unit circle during that Initialization period. It is calculated by: 

A il-inlt radius) . . (l - init ^radius) ] 

stretch radius - max 1, current counter • - — - — = - — - + \nit_ radius — — 

[ fin* «-i first _n-\ j 



wherein 
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current_counter is the number of times the process was run 
after initialization; 

initradius is the initial radius (which will be bigger than the unit 

circle); 

first_n is the initialization period, expressed in number of runs of 
the system; 

sigma is the number of standard deviations around the mean; this 
number determines how much variation the data is allowed without being 
classified as an abnormal condition; and 

x min is the minimum value of the data within the initialization set, 
computed by: 

x min = mean - stretch _ radius • scale • sigma (8) 

Normalization of the engine data allows a comparison of data which are 
subject to different calibration or constraints like minor design variations or 
material variations. In the case of the aircraft engine example, it allows 
comparison of different aircraft engines that are in different states of wear and 
that have differently tuned variables. An underlying basis of the normalization 
is that particular failures have directional information, which is retained over 
different engines and even engine families. For example, a variable Weed 
variable (VBV) failure results in increases of dEGT, WF, N2, and EGT 
divergence. On the other hand, a failure of a different component, e.g., a 
failure of a C-clip, will result in an increase of dEGT, WF, and EGT 
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divergence, while N2 will drop. These characteristic changes can be seen 
regardless of the differences in wear or other variations mentioned above. 
The normalization also provides a role in resetting the algorithm after engine 
changes, controller changes, major maintenance, etc, have been performed, 
which usually all involve the change of engine parameters. The normalization 
provides a semi-automated mechanism to calibrate the engine to new 
parameter settings. The first ji data points, where n is a number to be 
specified by the user, have to be of type "normal" and have to be verified by 
the user. 

If the system is re-initialized, then the data are initially allowed to take 
on larger variance to account for the settling process to proceed properly 
without misclassification. This can be envisioned as using a larger radius for 
the initial data, which is decreased sequentially with each new data point until 
a predefined radius for the variance is reached. The radius does not shrink 
after that. Fig. 4 shows an example depicting the initialization and 
normalization performed by the normalizer 32. 

Referring again to Fig. 3, the multivariate abnormal condition detector 
28 also comprises a classifier 33, which classifies the normalized data in a 
multi-dimensional variable space defined for the aircraft engine 12. 
Preferably, the multi-dimensional variable space comprises the dEGT, WF, 
N2, divEGT, divWF and divN2. As mentioned above, the classifier 33 
classifies the normalized data into a normal class or an abnormal class 
defined in the multi-dimensional variable space. The normal class is 
indicative of normal operating conditions for the aircraft engine and the 
abnormal class is indicative of potential alert conditions in the engine. 

The classifier 33 uses a fuzzy knn (k nearest neighbor) algorithm to 
establish whether a measurement belongs to either the normal class or the 
abnormal class. Representatives for the normal class are assumed to be 
within a circle around the mean of the normalization and are generated 
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accordingly. Data beyond that are considered abnormal and prototype data 
sets for both normal and abnormal classes are generated at the beginning of 
each run of performing the classification. Fig. 5 shows an example of a plot of 
a two-dimensional classification performed according to this invention. 

The fuzzy knn algorithm finds the k closest neighbors and calculates a 
degree of belonging to either the normal class or abnormal crass. This 
invention uses a fuzzy knn algorithm similar to the one disclosed in Keller et 
al M A Fuzzy K-Nearest Neighbor Algorithm, IEEE Transactions of Systems, 
Man and Cybermetrics, Vol, SMC-15, No. 4, pp. 580-585, July/August 1985, 
which is incorporated herein by reference. Using the fuzzy knn algorithm, the 
classifier 33 first finds the distance from the input vector to the closest 
neighbor. If the number of k neighbors has not yet been established, the 
closest neighbor is included in the set of k-nearest neighbors. If there are 
already k-nearest neighbors and the newly found neighbor is closer to the 
input vector than the farthest nearest neighbor, then the farthest nearest 
neighbor is replaced by the newly found nearest neighbor. This process is 
repeated until all data points are evaluated. The degree of belonging 
associated with this fuzzy knn algorithm is given by: 



\ 



(9) 
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± 




where 



x Is the data point; 
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u is the degree of belonging to a class (membership); and 



m is a tuning parameter which determines the steepness of the 
membership curves between the classes. 

The statistical property estimator 30, adaptor 31 , normalizer 32 and the 
classifier 33 of the multivariate abnormal condition detector 28 are embedded 
in a computer such as a workstation, however, other types of computers can 
be used such as a mainframe, a minicomputer, a microcomputer, or a 
supercomputer. The algorithms performed in the statistical property estimator 
30, adaptor 31, normalizer 32 and the classifier 33 are programmed in Vbasic 
and MATLAB, but other languages such as JAVA may be used. 

Fig. 6 shows a more detailed view of the alert evaluator 29. As 
mentioned above, the alert evaluator 29 evaluates the classified data. The 
alert evaluator comprises a persistency checker 38 as shown in Fig. 6. The 
persistency checker 38 determines the vigilance level of the data for each 
reading for related variables. The persistency checker 38 is preferably a 
digital filter, which has a dampening effect. If suspicious data are 
encountered, the persistency checker 38 increases a vigilance level by one 
notch at a time. If the following data point is normal, then the persistency 
checker 38 decreases the vigilance level by one notch. In this invention, the 
persistency checker has a user-specified alert limit that controls how much 
dampening is allowed. If the user-specified alert limit is reached, then the 
persistency checker 38 cuts off further increases and holds the vigilance at 
the alert limit until normal data are encountered. The alert limits work both in 
the positive and negative direction. The effect of the persistency checker 38 
is that alerts are not reported hastily. Rather confirmation of the initial suspect 
data is required to increase the level of alertness. Thus, changes from the 
normal region to the abnormal region and from the abnormal region to the 
normal region do not reset the alerting mechanism immediately. In the latter 
case, the persistency checker 38 keeps the level of suspicion high. 
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Referring to Fig. 6, the alert evatuator 29 also comprises a composite 
alert score generator 40. The composite alert score generator 40 generates 
an alert score based on the vigilance level for each of the related variables. In 
addition, the composite alert soore generator 40 aggregates the alerts found 
at individual directly and indirectly related feature pairs. In particular, the 
maximum value of all vigilances is forwarded to the aggregate score and used 
as the aggregate value. The objective of the composite alert score generator 
40 is to report the maximum number of the alerts to enable notification of the 
user of any abnormal condition in any of the features. 

Figs. 7a-7d show an example of plots used to determine the composite 
alert score. Fig. 7a shows a plot of the sub-alert vigilance values and alfidS 
for the related variable pairs of dEGT and divEGT, Fig, 7b shows a plot of the 
sub-alert vigilance values and alerts for the related variable pairs of WF and 
dlvWF, and Fig. 7c shows a plot of the sub-alert vigilance values and alSEtS for 
the related variable pairs of N2 and divNT. The composite alert score 
generator 40 aggregates the alerts found at each individual directly and 
indirectly related feature pairs as shown in Figs. 7a-7c. Fig. 7d shows a plot 
of the aggregate scores for the pairs dEGT and divEGT, WF and divWF, and 
N2 and divN2. The aggregation is performed by taking the maximum value of 
the individual vigilance values for the feature sets dEGT and divEGT, WF and 
divWF, and N2 and divN2. 

Like the statistical property estimator 30, adaptor 31, normalizer 32 and 
classifier 33 of the multi-variate abnormal condition detector 28, the 
persistency checker 38 and composite alert score generator 40 of the alert 
evaluator 29 are embedded in a computer such ae a workstation, however, 
other types of computers can be used such as a mainframe, a minicomputer, 
a microcomputer, or a supercomputer. The algorithms performed in the 
persistency checker 38 and composite alert score generator 40 are 
programmed in VBasic and MATLAB, but other languages such as JAVA may 
be used. 
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Fig. 8 shows a flow chart setting forth the steps performed by the 
aircraft engine monitoring system 26 shown in Fig. 2. Engine data are 
sampled from the aircraft engine at 42 at different times of the flight such as 
during take-off, climb and cruise. The engine data are transmitted to a 
centralized data center system at 44 and stored in a database at 46. The 
data are preprocessed at 48 to ensure that there are no missing data entries 
for any particular variable and that the data are new. After preprocessing, the 
data are evaluated by the multi-variate abnormal condition detector 28. In 
particular, statistical properties from the engine data are estimated and 
smoothed to follow slow drifts that develop over time. In addition, the data 
are normalized individually for each engine variable by centering them around 
a chosen center point at 50. Next, the data are classified at 52 to either the 
normal class or abnormal class using the fuzzy knn algorithm. After the data 
have been classified, the data are evaluated at 54 to determine whether the 
data indicate an existing or impending fault. As mentioned earlier, this 
includes determining the vigilance level of the data for each of the related 
variables. Next, an alert score based on the vigilance level for each of the 
variables is generated and a composite alert score is aggregated at 56. The 
composite alert score is used to produce an alert report, which is used by an 
aircraft engine expert to suggest appropriate diagnostic and/or remedial 
actions. A schedule of actions is then prepared and used by maintenance 
personnel. 

In another embodiment of this Invention, the multi-varlate abnormal 
condition detector and alert evaluator are used In conjunction with the trend 
performance analysis tool to validate alerts generated therefrom. Fig. 9 
shows a block diagram of a system 58 for monitoring and maintaining an 
aircraft engine according to this embodiment. In this embodiment, the multi- 
variate abnormal condition detector 28 and alert evaluator 29 work in parallel 
with the trend performance analysis tool 18, however, both may be integrated 
into the tool. As in the embodiment set forth in Fig. 2, the multi-varlate 
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abnormal condition detector 28 estimates statistical properties from the 
engine data obtained from the aircraft engine 12 and smoothes the data to 
follow slow drifts that develop over time. In addition, the multi-variate 
abnormal condition detector 28 normalizes the data and then uses the fuzzy 
knn algorithm to establish whether the data belong to either the normal class 
or the abnormal class. The alert evaiuator 29 then evaluates the classified 
data and determines the level of vigilance. The alert evaiuator uses the 
persistency checker and composite alert score generator In the 
aforementioned manner. Fig. 10 shows a more detailed view of the multi- 
variate abnormal condition detector 28 and the alert evaiuator 29 used to 
validate alerts in the trend performance analysis tool. 

Fig. 11 shows a flow chart setting forth the steps performed by the 
aircraft engine monitoring system 58 shown in Fig. 9, Engine data are 
sampled from the aircraft engine at 60 at different times of the flight such as 
during take-off, climb and cruise. The engine data are transmitted to a 
centralized data center system at 62 and stored in a database at 64. The 
data are preprocessed at 66 to ensure that there are no missing data entries 
for any particular variable and that the data are new. After preprocessing, the 
data are evaluated by the trend performance analysis tool at 68 where the 
data for each variable are compared against trending baseline data, if the 
data for a particular engine variable exceed a predetermined threshold limit, 
then the trend performance analysis tool issues an alert 

At the same time the engine data are being evaluated by the trend 
performance analysis tool, the data are simultaneously evaluated by the 
multi-variate abnormal condition detector and the alert evaiuator. In 
particular, statistical properties from the engine data are estimated and 
smoothed to follow slow drifts that develop over time. In addition, the data 
are normalized individually for each engine variable at 70, Next the data are 
classified at 72 to either the normal class or abnormal class using the fuzzy 
knn algorithm. After the data have been classified, the data are evaluated at 
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74 to determine the level of vigilance. Next an alert score based on the 
vigilance level for each of the related variables is generated and a composite 
alert score is aggregated at 76. After the composite alert score has been 
determined, then the alerts from the trend performance tool are validated at 
78 by comparing alert messages from the current trend performance analysis 
tool and the composite alert score, If both indicate an alert, then the alert is 
considered validated, otherwise it is not. 

It is therefore apparent that there has been provided In accordance 
with the present invention, a system and method that provides improved alert 
generation for trend performance analysis. The invention has been described 
with reference to several embodiments, however, It will be appreciated that 
variations and modifications can be effected by a person of ordinary skill In 
the art without departing from the scope of the invention. 

4. Brief Description of Drawings 

Fig. 1 shows a block diagram of a system for monitoring and 
maintaining an aircraft engine according to the prior art; 

Fig. 2 shows a block diagram of a system for monitoring and 
maintaining an aircraft engine according to this invention; 
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Fig, 3 shows a more detailed view of the multi-variate abnormal 
condition detector shown in Fig. 2; 

Fig. 4 shows an example depicting the initialization and normalization 
performed by the normalizer in the multi-variate abnormal condition detector; 

Fig. 5 shows an example of a plot of a two-dimensional classification 
performed according to this invention; 

Fig. 6 shows a more detailed view of the alert evaluator shown in Fig. 

2; 

Figs. 7a-7d show an example of plots used to determine the composite 
alert score according to this invention; 

Fig. 8 shows a flow chart setting forth the steps performed by the 
aircraft engine monitoring system shown in F?g. 2; 

Fig. 9 shows a block diagram of a system for monitoring and 
maintaining an aircraft engine according to another embodiment of this 
invention; 

Fig. 10 shows a more detailed view of the multi-variate abnormal 
condition detector and the alert evaluator used to validate alerts in the trend 
performance analysis tool; and 



Fig. 1 1 shows a flow chart setting forth the steps performed by the 
system shown in Fig. 10. 
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1. Abstract 

This invention provides an improved alert generation system 26 and 
method for trend performance analysis. A multi-variate abnormal condition 
detector 28 normalizes data obtained from a process and ctassifies the data 
in a multi-dimensional space defined for the variables in the process. The 
normalized data are classified into either a normal or abnormal class. An 
alert evaluator 29 evaluates the data classified in the abnormal class and 
determines whether the data are a true alert or a false alert, In another 
embodiment, the multi-variate abnormal condition detector 28 and alert 
evaluator 29 are used in parallel with a trend performance analysis tool 1 8 to 
validate alerts generated therefrom. 

2. Representative Drawing: Figure 2 
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